Re: Telnet and FTP to Historic

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Dec 2, 2020 at 12:57 PM Michael Richardson <[e-mail]>
wrote:

>
> Carsten Bormann <[e-mail]> wrote:
>     > On 2020-12-02, at 17:38, Adam Roach <[e-mail]> wrote:
>     >>
>     >> If it helps: I've yet to find a system that lacks both telnet and
> nc (netcat) out of the box.
>
>     > Indeed, interestingly, for me, nc replaces the existing usages of
> both
>     > telnet and ftp (i.e., unencrypted and third-party transfers).  Except
>     > that my brain cannot teach my fingers to stop typing “telnet”, so I
>     > usually have that installed in some form (e.g., inetutils) as well.
>
> neither nc or telnet is installed on Ubuntu or Windows or openwrt by
> default now.
> I don't think it's installed by default on RASPbian either.
> (Hard for me to double check, as naturally, I wind up installing both
> immediately)
>
> Like Carsten, I have difficulty not using telnet when I should be using nc.
> (But, I don't find I should have -t on by default, which is why nc rather
> than telnet.  Ah, I remember back writing that proxy-telnet...)
>

I used to find this an issue and then I started to hit problems because
modern servers increasingly have timeouts on commands to prevent port
exhaustion DoS attacks. So I stopped debugging by hand and wrote a bunch of
different code...

But even if every developer needs to use telnet for debugging on a daily
basis, that is still no reason for telnet to keep its standards status. I
would like to see us being more aggressive in rendering old protocols
obsolete so as to encourage new ones. and to discourage continued use of
insecure protocols.


Take the main remaining use of FTP for example - syncing to cameras over
ethernet. Sure, thats one way to do it. But its insecure which is something
of a problem when the professionals using it are often reporters or
forensics practitioners.